Free practice · No sign-up required
15 questions with answer explanations. Choose an answer below to begin.
What is the primary purpose of a Security Information and Event Management (SIEM) system?
Understand the role of SIEM in security monitoring.
0/15 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.
Learn by doing
Use official documentation and hands-on labs to work through topics you missed.
An intentionally vulnerable application for practicing web security in a controlled lab. Useful supplementary work for application-security topics.
Try it: Run a local, isolated instance using the project's instructions. Complete one introductory challenge, explain its root cause, and write the server-side control that would prevent it.
Open-source application; can run locally. Keep the intentionally vulnerable app isolated from public networks.
OWASP's testing methodology adds structure to application-security review. It supplements exam objectives rather than replacing a certification owner's guide.
Try it: Choose one testing category relevant to a missed question. In your own lab, record the test precondition, expected secure behavior, evidence, and remediation.
Free to read. Perform exercises only in your own lab or an explicitly authorized environment.
Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.
What is the primary purpose of a Security Information and Event Management (SIEM) system?
To collect, correlate, and analyze security event data
To replace firewalls and endpoint protection
To store backup copies of all network traffic
To manage user identity and access permissions
Correct answer
To collect, correlate, and analyze security event data
A SIEM system centralizes log and event data to detect and respond to threats. It correlates events across sources to identify patterns indicative of malicious activity.
Which Splunk component is responsible for collecting data from endpoints and forwarders?
Search Head
Indexer
Forwarder
Deployment Server
Correct answer
Forwarder
Forwarders are responsible for collecting and sending data to indexers. They can be configured to monitor logs, metrics, and other data sources.
What does a correlation search in Splunk typically do?
It runs scheduled reports for compliance audits
It detects patterns across events to identify potential threats
It indexes raw data for long-term storage
It manages user permissions and roles
Correct answer
It detects patterns across events to identify potential threats
Correlation searches analyze event data over time to find related events that may indicate security incidents such as intrusions or policy violations.
Which log source is most critical for detecting compromised credentials?
Web server access logs
Authentication logs
Firewall traffic logs
Application error logs
Correct answer
Authentication logs
Authentication logs record user login attempts and account activities, making them essential for spotting brute force attacks or unusual access patterns.
What is the purpose of field extraction in Splunk?
To delete unnecessary data from indexes
To structure unstructured data into searchable fields
To encrypt data at rest
To schedule automated report delivery
Correct answer
To structure unstructured data into searchable fields
Field extraction parses raw events to identify and isolate key pieces of information, enabling more precise searches and analytics.
Which practice helps reduce noise and improve detection accuracy in Splunk?
Disabling all alerts
Normalizing event formats and filtering irrelevant data
Increasing data retention indefinitely
Using only default dashboards
Correct answer
Normalizing event formats and filtering irrelevant data
Normalization and filtering ensure that only relevant, structured events are analyzed, improving signal-to-noise ratio for detections.
Which Splunk search command is used to count events by a specific field?
stats count by field_name
search count by field_name
count field_name
group field_name
Correct answer
stats count by field_name
The stats command with count and by is used to aggregate event counts based on the values of a specific field.
What is the role of an indexer in Splunk architecture?
To visualize dashboards for end users
To parse and store indexed data for searching
To generate synthetic test data
To manage network routing
Correct answer
To parse and store indexed data for searching
Indexers receive data from forwarders, parse it, and store it in indexes to enable fast and efficient searching.
Which type of data is most useful for detecting lateral movement in a network?
Email metadata
Authentication and process execution logs
Software installation logs
Printer job logs
Correct answer
Authentication and process execution logs
Authentication and process execution logs reveal user and system activities, helping to identify unauthorized movement between systems.
What is a best practice for managing Splunk user roles?
Assign all users the admin role for simplicity
Use role-based access control to limit permissions
Disable authentication to improve performance
Share one account across the team
Correct answer
Use role-based access control to limit permissions
Role-based access control ensures users have only the permissions needed for their tasks, improving security and compliance.
Which activity is most aligned with proactive threat detection in Splunk?
Reviewing logs only after an incident occurs
Setting up alerts for known indicators of compromise
Archiving all data without analysis
Disabling real-time monitoring
Correct answer
Setting up alerts for known indicators of compromise
Proactive detection involves configuring alerts for suspicious patterns so that threats can be identified and responded to before damage occurs.
Which technique is most effective for detecting credential theft in Splunk?
Monitoring for unusual authentication patterns across multiple hosts
Tracking disk usage trends over time
Analyzing web server response codes
Counting total user logins per day
Correct answer
Monitoring for unusual authentication patterns across multiple hosts
Detecting credential theft involves identifying anomalies in authentication behavior, such as logins from unusual locations or at odd times, which can be effectively monitored using Splunk.
Which protocol is most commonly used for secure log transmission to Splunk?
HTTPS
SSL/TLS
FTP
SMTP
Correct answer
SSL/TLS
SSL/TLS is the standard protocol for encrypting and securely transmitting log data to Splunk.
What is the purpose of a lookup table in Splunk security analytics?
To store raw event data permanently
To enrich events with external reference data
To replace field extraction
To reduce search processing time
Correct answer
To enrich events with external reference data
Lookup tables are used to enrich events by mapping internal fields to external reference data, enhancing threat context.
Which behavior is a strong indicator of credential compromise in network logs?
Single login from a trusted IP
Multiple failed logins followed by a success from a new location
Consistent login times
Use of multi-factor authentication
Correct answer
Multiple failed logins followed by a success from a new location
Multiple failed attempts followed by a successful login from an unusual location is a classic sign of credential stuffing or brute-force attacks.
Recall the answer before opening each card.
To collect, correlate, and analyze security event data from various sources for threat detection and response.
Forwarder. Forwarders gather logs and send them to indexers, optionally performing light processing.
Detects patterns across events over time to identify potential threats like intrusions or policy violations.
Authentication logs. They record login attempts and account activities, essential for spotting brute force or unusual access.
To structure unstructured data into searchable fields, enabling precise searches and analytics.
By normalizing event formats and filtering irrelevant data, improving the signal-to-noise ratio.
stats count by field_name. It aggregates event counts per field value.
To parse and store indexed data for fast searching. Indexers receive data from forwarders and write to indexes.
Authentication and process execution logs reveal user and system activities for identifying unauthorized movement.
Use role-based access control (RBAC) to limit permissions to only necessary capabilities.
Setting up alerts for known indicators of compromise (IoCs) to identify threats early.
Monitoring for unusual authentication patterns across multiple hosts, such as logins from unusual locations at odd times.
SSL/TLS encrypts log data during transit to prevent eavesdropping and tampering.
To enrich events with external reference data, enhancing threat context and prioritization.
Multiple failed logins followed by a success from a new location suggests credential stuffing or brute-force.
Indexers and search heads. Indexers parse/store data; search heads provide the search interface.
A lightweight forwarder that sends raw data to indexers without parsing; used for maximum performance.
A heavy forwarder can parse and filter data before forwarding, reducing load on indexers.
transaction groups events based on common fields like session ID, useful for multi-step attacks.
A set of standard field names and tags to normalize data across sources, enabling easier correlation.
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Connect the concepts
Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
The practice bank begins with foundational knowledge of SIEM systems and Splunk's component roles. A SIEM centralizes and correlates security event data from diverse sources to detect threats. In Splunk, forwarders collect logs and send them to indexers, which parse and store the data for searching. Correlation searches analyze event patterns across multiple sources to identify potential incidents. Understanding these roles and the purpose of field extraction—turning raw data into structured, searchable fields—is essential. Mastery of these concepts enables you to design effective data pipelines and detection logic.
Effective security monitoring relies on proper data collection and normalization. The practice bank highlights authentication logs as critical for detecting compromised credentials and lateral movement. Secure log transmission uses SSL/TLS to protect data in transit. Data normalization—standardizing event formats and filtering irrelevant data—reduces noise and improves detection accuracy. Field extraction structures unstructured data, making it searchable. Using lookup tables enriches events with external reference data, adding critical context for threat analysis.
The practice bank emphasizes proactive detection of credential theft and lateral movement. Monitoring for unusual authentication patterns across multiple hosts is highly effective for identifying credential theft. Indicators include multiple failed logins followed by a success from a new location. For lateral movement, authentication and process execution logs are most useful. Setting up alerts for known indicators of compromise (IoCs) constitutes proactive threat detection. Correlation searches detect patterns across events, such as brute-force attempts followed by access, enabling timely response.
The practice bank covers operational best practices. The stats count command by field_name aggregates event counts, useful for summarizing activity. Role-based access control limits user permissions to essential functions, enhancing security. Lookup tables enrich events with external data, improving threat context. Understanding these practices ensures efficient searches, secure user management, and enriched analytics. Combining these with proper data normalization and secure transmission creates a robust defense analytics environment.
Study workflow
Select appropriate forwarder type (universal or heavy) based on volume and need for transformation. Install forwarders on endpoints and servers. Configure inputs.conf to monitor relevant log files such as authentication logs, process execution logs, and firewall logs. Ensure forwarders point to indexers or a heavy forwarder for load balancing.
Use Splunk's field extractor tool or props.conf/transforms.conf to create custom extractions for key fields like src_ip, user, and action. Apply data normalization by renaming fields to common names (e.g., dest_ip) using alias or replace rules. Filter out noise by setting _INDEX_TERMINATING_BOOLEAN or using search-time eval to drop irrelevant events.
Identify common attack patterns (e.g., brute force, lateral movement) and define them as correlation searches. Use subsearches or transactions to link related events. For credential theft, a search might look for more than 5 failed logins from one source within 1 minute, followed by a successful login. Schedule the search and set severity-based alerts.
Analyze user job functions and assign appropriate roles in Splunk. Use the Out-of-Box (OOB) roles such as 'user' and 'power' or create custom roles with specific capabilities. Restrict access to sensitive indexes (e.g., _audit) and enable the 'search job runtime' capability only for analysts who need it.
Create CSV or KV store lookups for threat intelligence feeds (e.g., known malicious IPs). In a search, use lookup command to append fields like threat_severity. Alternatively, use automatic lookup in props.conf to enrich events at search time. Validate that the lookup key field matches the event field.
FAQ
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
Forwarders collect data from various source endpoints (servers, network devices) and send it securely to indexers for processing and storage. They can perform light filtering or transformation with heavy forwarders, but the core function is data collection and transmission.
A correlation search is designed to detect patterns across multiple events or over time, often using subsearches, transactions, or joins. It identifies relationships indicative of threats, such as brute force followed by access. A simple search returns raw events without cross-event analysis.
Authentication logs record login attempts, success/failure, account used, source IP, and timestamp. Analyzing patterns—such as many failures from one IP followed by a success—directly indicates credential stuffing or brute force. These logs are the first data source for identity threats.
Field extraction structures unstructured log data into key-value pairs (e.g., src_ip, dest_port). This enables precise searches, aggregation (via stats), and correlation across events. Without extraction, raw events remain opaque and cannot be analytically processed effectively.
Lookup tables enrich events with external reference data, such as IP reputation lists or asset details. By adding context like threat_score or department, analysts can prioritize alerts. For example, a login from an IP in a known malicious block can be flagged immediately.
Browse another free bank or use the study strategy guide to turn your misses into spaced review.
